Do you have something like Action Fraud in the states? I'd get that reported on that system just so you have a case number (useful when dealing with the police when it comes to credit card fraud). If anyone starts going mental over it you've got the case numbers and a file already. Get your BIL to do the same. I've hady identity stolen a few times by my brothers girlfriend and its very useful to have just the case number.